Unexpected email from your WordPress site: password reset, technical issue or a hack?

Did your WordPress site email you a password reset link you never asked for? Nothing changes unless you click the link: your password stays the same, and the link only went to your own inbox. Most of the time a bot is submitting the Lost your password? form on thousands of sites at once. You can safely ignore or delete the email.

Below you'll find what each email from your site means (password resets, technical issues, updates, new users and security plugins), when you should act, and how to change your WordPress password in Plesk when you can't log in.

Password reset email you didn't request: what happened?

Every WordPress login form has a Lost your password? link. Anyone who knows your username or email address can request a reset link there. WordPress always sends that link to the email address of the account, never to the person who asked for it. A typical reset email looks like this (made-up example):

Subject: [Your website] Password Reset

Someone has requested a password reset for the following account:
Site Name: Your website
Username: yourname

If this was a mistake, ignore this email and nothing will happen.

To reset your password, visit the following address:
https://yourdomain.com/wp-login.php?login=yourname&key=...&action=rp

This password reset request originated from the IP address 192.0.2.10.

What you need to know:

• No click, no change. Your current password keeps working, exactly as the email says.
• The link expires. By default a WordPress reset link expires after 24 hours. A new request replaces the previous link, and a link stops working once it has been used.
• The IP address at the bottom shows where the request came from. If you don't recognise it, for example because it's in another country, the request didn't come from you or your team. You still don't need to do anything.
• Your username isn't a secret. Bots often find it on your own site, for example through your author page. If these emails keep coming, use a strong, unique password and turn on two-factor authentication with a plugin.

Did you request the reset yourself? Click the link within 24 hours, choose a new password and click Save Password.

Real reset email or phishing? How to tell

Scammers also send emails that look like a reset email, hoping to steal your password. These signs help you spot a genuine email from your site:

A real reset email never asks for your current password. When in doubt, don't click the link: go to yourdomain.com/wp-admin yourself and log in as usual. Read more about recognising phishing in email security against phishing, spam and abuse.

What does each WordPress email mean?

WordPress sends site notifications to the Administration Email Address (Settings > General in WordPress) and account notifications to the email address of that account. The subject always starts with your site name in square brackets. If your site runs in another language, the subjects are translated.

"Your Site is Experiencing a Technical Issue": what to do

WordPress watches for plugins and themes that cause a fatal error. When that happens, you get this email with the name of the plugin or theme, the page where the error occurred and a link to recovery mode. Visitors to that page may see "There has been a critical error on this website." It is an error on your site, not a sign of a hack.

1. Open your site and the page mentioned in the email. If everything works, the error happened once, for example during an update. Check the error log in Plesk to see whether it comes back.
2. If a page or your dashboard is broken, click the link in the email and log in. In recovery mode WordPress pauses the faulty plugin or theme for you only, so you can work in your dashboard.
3. Go to Plugins (or Appearance > Themes) and update the item, or click Deactivate.
4. Click Exit Recovery Mode at the top and open your site again.

By default the link in the email works for one day. If the error comes back after that, WordPress sends a new email, at most once a day. If the link doesn't get you into your dashboard either, disable the plugin in Plesk as described in view error logs in Plesk, or have a backup restored (see backups at LJPc hosting).

Emails from Wordfence and Limit Login Attempts Reloaded

Security plugins send their own emails. Most of them tell you the plugin stopped someone.

By default Limit Login Attempts Reloaded blocks an IP address for 20 minutes after 4 failed attempts, and for 24 hours after 4 of those lockouts. Both plugins email the address in their own settings; in Wordfence that setting is called Where to email alerts.

On our servers fail2ban also watches the WordPress login. After a few failed attempts it blocks the IP address for every website on that server. Read how that works in what is fail2ban.

You suddenly can't log in to WordPress

How to change your WordPress password in Plesk

If you can't get into WordPress, or the reset email doesn't arrive, change the administrator password in Plesk with WP Toolkit. You don't need your old password or access to your mailbox.

1. Open Plesk from the customer portal. See open Plesk from the customer portal.
2. Go to Websites & Domains and open the WordPress tab in the card of your domain. If you don't see any WordPress details there, click WordPress in the left menu and then Scan, so WP Toolkit finds your site.
3. On the left of the card, under Log in to WordPress, click Setup next to the Log in button.
4. Choose the user under Administrator; if your site has one administrator, the name is already filled in. Enter a new password under New password, or click Generate and copy the password into your password manager with the button next to it. Leave the other fields as they are and click Change.

Then log in at yourdomain.com/wp-admin with the new password, or click Log in in the same card. WordPress emails the user that the password was changed. If you receive such an email without changing anything, first check whether a colleague or your web developer changed the password in Plesk.

A new password also signs out anyone who was still logged in with the old one. If you can still get into WordPress, change it there: go to Users > Profile, click Set New Password under Account Management, then Update Profile at the bottom.

Wasn't you? How to handle a possible break-in

A reset email on its own is not a break-in. Act right away if you see any of these:

• an email saying your password or email address was changed, when you and your colleagues didn't;
• an administrator login alert that wasn't you or a colleague;
• an administrator under Users you don't know;
• your password stops working although you're sure it was right.

1. Change the password of your administrator account in Plesk, as described above. This works even if someone changed the email address of your account.
2. In WordPress, go to Users > All Users. Delete accounts you don't recognise or give them a lower role, and check the email address of your own account.
3. In your profile, revoke anything you don't recognise under Application Passwords. Those keep working after you change your normal password.
4. Under Settings > General, check the Administration Email Address. Leave Anyone can register off unless visitors create their own accounts, and never set the New User Default Role to Administrator.
5. Update WordPress, your plugins and your theme, and remove plugins you don't use. See how to update WordPress safely.
6. Look for files on your site that don't belong, using the steps in malware alert from LJPc.
7. Change other passwords that were the same, check Have I Been Pwned to see whether your email address appears in a data breach, and turn on two-factor authentication.

Want us to take a look, or restore a backup from before the break-in? Create a support ticket. Read which backups exist and how a restore works in backups at LJPc hosting.

What LJPc hosting takes care of

• On our servers fail2ban blocks IP addresses that try to guess WordPress passwords (see what is fail2ban).
• Plesk includes WP Toolkit, where you change passwords and update WordPress, plugins and themes.
• Our nightly malware scan emails you when it finds malicious files on your website (see malware alert from LJPc).
• Every night we back up your website, databases and email (see backups at LJPc hosting).